LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 11-01-2007, 04:45 PM   #1
dkm999
Member
 
Registered: Nov 2006
Location: Seattle, WA
Distribution: Fedora
Posts: 407

Rep: Reputation: 35
NFS: multi-home client uses wrong address


I am running Fedora 7, and have come across a problem with NFS mount:

I cannot find a way to tell the mount command (issued on my firewall machine) to use a particular interface IP address for its NFS mount request. The result is that I have to put an extra address declaration in every NFS server on my network; one to cover most of the machines in this shop (192.168.1.0/24), and a second one to handle the special case of the firewall host, which has two addresses.

Incidentally, the address this firewall host is using happens to be the one for eth0, not eth1, which is where the UDP packets go to request the NFS mount.

Any (non-vulgar) suggestions will be gratefully accepted.
 
Old 11-03-2007, 02:31 AM   #2
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 671Reputation: 671Reputation: 671Reputation: 671Reputation: 671Reputation: 671
Is each interface on a distinct subnet or network?
 
Old 11-04-2007, 08:07 PM   #3
dkm999
Member
 
Registered: Nov 2006
Location: Seattle, WA
Distribution: Fedora
Posts: 407

Original Poster
Rep: Reputation: 35
Yes; this is a firewall system. eth0 is my public IP address, and eth1 has an IP address of 192.168.x.1. My routing table has the public (eth0) address as its default route.

All private addresses are translated (SNAT) on the firewall into the (one) public IP address that I have assigned to me.

HTH
 
Old 11-06-2007, 05:00 AM   #4
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 671Reputation: 671Reputation: 671Reputation: 671Reputation: 671Reputation: 671
I don't see why the other interface would be used because the hostname should resolve to the 192.168.1.0/24 network. I don't think that the NFS servers inside your network should know anything about the outside.

When you mentioned your routing table, do you mean the routing table on the firewall? The default gateway for the other hosts should be your firewall's eth1 IP address.

The first part of the message indicates that the firewall is mounting shares on other hosts in your lan. I take it that this computer has other roles, and is also being used as a gateway.

Quote:
The result is that I have to put an extra address declaration in every NFS server on my network
By address declaration, are you referring to /etc/hosts, or are you referring to /etc/exports.
Using "192.168.1.0/24" should be sufficient to only allow exporting shares to hosts on the lan. On one of these hosts, what does "host <firewall-hostname>" return. I think it should be the address of eth1 and only the address of eth1.

Is the firewall host also running a DNS server? Sometimes a dns server is running inside a LAN to resolve local hostnames. A dns server is run on the outside of the LAN in the DMZ to resolve address outside the network. The inside DNS knows nothing about outside addresses. Conversely the outside DNS knows nothing about LAN hosts. However the outside DNS does have the address of the mysql server in it's /etc/hosts file for it's own use. But there is no entry for it in the directory. Maybe a misconfigured DNS server could be causing a problem, but this is just a guess. I'm trying to understand why eth0 would even be considered? Even if the eth0 IP address has a registered domain name, it should resolve to a local address first without having to query a DNS server that would have that info. Could the order of the entries in the "hosts: ..." line of your /etc/nsswitch.conf file or /etc/host.conf file be wrong?
Quote:
Originally Posted by /etc/host.conf
order hosts, bind
Quote:
Originally Posted by /etc/nsswitch.conf
hosts: files mdns4_minimal [NOTFOUND=return] dns
networks: files dns

services: files
protocols: files
rpc: files
ethers: files
netmasks: files
netgroup: files nis
publickey: files

bootparams: files
automount: files nis
Check your entries for hosts, networks, rpc and automount. If you use NIS, do you have conflicting information between what /etc/hosts says and NIS? Imagine if some hosts have an entry in /etc/hosts, while others don't and NIS returns different info. I doubt that is the case because you would have more serious problems. I'm just trying to brainstorm here. ( I hope I'm not showing signs of AADD here!)
 
Old 11-07-2007, 01:43 AM   #5
dkm999
Member
 
Registered: Nov 2006
Location: Seattle, WA
Distribution: Fedora
Posts: 407

Original Poster
Rep: Reputation: 35
I guess I needed to be clearer about who the actors in this problem are.

The firewall machine has quite a few uses in addition to packet filtering; it is in use for mail transport, public and private DNS, HTTP and HTTPS, and a local NTP source, to name a few. In some of its roles, I have wanted to NFS mount parts of the filesystems on other machines behind the firewall. If I attempt to perform this mount by issuing a command to a shell on the firewall, it fails. If I issue a mount command on any of the other machines naming the firewall as the remote target, it succeeds (if the right entry is in /etc/exports.

If I attempt a mount
Quote:
firewall -> local_machine
it fails. The local machine log then contains a notation that an NFS
request has been denied from {firewall_public_address}.

On the firewall machine, if I issue the command
Quote:
# dig firewall.digitalelephant.org
I get this reply
Quote:
; <<>> DiG 9.4.2b1 <<>> firewall.digitalelephant.org
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35854
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;firewall.digitalelephant.org. IN A

;; ANSWER SECTION:
firewall.digitalelephant.org. 86400 IN A 192.168.207.1

;; AUTHORITY SECTION:
digitalelephant.org. 86400 IN NS fiewall.digitalelephant.org.

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Nov 6 22:20:41 2007
;; MSG SIZE rcvd: 74
I do not have NSS configured or running. The default route I mentioned in my first post is the default route on the firewall.

The "extra declaration" that I find necessary is on every machine behind the firewall, to allow the firewall NFS mounts to succeed. It has gone into /etc/exports, and is an addition to the 192.168.x.0/24 that I, too, would have expected to be sufficient.

My /etc/host.conf file has one line: order hosts, bind. The file /etc/hosts contains only 3 lines (plus comments)
Quote:
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
192.168.207.1 firewall.digitalelephant.org firewall
In short, I haven't a clue as to why the NFS mount is using the wrong address, either.
 
Old 11-07-2007, 02:18 AM   #6
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 671Reputation: 671Reputation: 671Reputation: 671Reputation: 671Reputation: 671
It seems to me that when the firewall refers to itself, it is using an outside dns instead of the local files and the address returned is for eth0 instead of eth1. That is why I was interested in the /etc/host.conf and nsswitch.conf.

Part of the problem may be that you are using the same host for outside and inside DNS. The outside DNS should be in the DMZ. Suppose one of the hosts is called "dumbo". Do you get an inside address or an internet address for dumbo if you ping dumbo from the firewall, or run "host dumbo". I think that each host may be resolving to the internet address instead of a local address (on the firewall), causing the nfs mount to fail.
 
Old 11-08-2007, 12:28 PM   #7
dkm999
Member
 
Registered: Nov 2006
Location: Seattle, WA
Distribution: Fedora
Posts: 407

Original Poster
Rep: Reputation: 35
I thought of that, too; that is why I posted the text returned from the dig command (executed on the firewall). That transcript clearly shows that the firewall machine (which is issuing the flawed NFS request) is able to resolve its own name to an IP address on eth1, rather than to the public IP address on eth0.

Similarly, the other systems on the local net resolve the firewall's name to its internal address (192.168.x.1). I just verified that the command to have the firewalll ping itself also resolves the name to the local address.

It is true that I have configured DNS to have a split personality. The way I have done this is to run two separate named daemons. The local daemon is authoritative for the local domain, listens on 192.168.x.1 and on 127.0.0.1, and only hands out 192.168.x.y addresses. It consults the root name servers for names it does not know (via the hints in named.ca). The public named daemon listens only on the public IP address, and is authoritative for the public view of my domain. The only address it hands out is my public IP address, and that only for host names in its zone table.

So I think we are right where I began: I haven't a clue as to why NFS is behaving this way.
 
Old 11-29-2007, 01:57 PM   #8
dkm999
Member
 
Registered: Nov 2006
Location: Seattle, WA
Distribution: Fedora
Posts: 407

Original Poster
Rep: Reputation: 35
SOLVED: As with lots of problems, the trouble wasn't with the subsystem that was exhibiting the symptoms. Instead, I had an overeager rule in my iptables ruleset, which did SNAT on all packets in the POSTROUTING stage, even if the actual destination was the local net. Restricting this rule so that packets that were outbound into the greater Internet solved the problem (and a couple of other nasty ones, too.) [sheepish grin.]
 
  


Reply

Tags
solution


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
SUSE NFS client can't detect an NFS server RedBoot SUSE / openSUSE 4 01-20-2009 12:56 AM
NFS client = Linux, NFS server = Mac OS X Tiger --> Hell of a problem make Linux - Networking 9 03-10-2006 06:16 AM
nfs client on knoppix 3.9 - problem mounting nfs drive Rod Butcher Linux - Networking 1 09-21-2005 05:18 AM
SuSE 9.0 NFS client with RHL 7.3 NFS server ocjacob Linux - Networking 0 02-01-2005 02:01 PM
nfs client should it use tcp or udp to nfs serve rportmapper andersonas Linux - Networking 2 06-30-2004 01:05 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 01:34 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration